Blog
Get the latest news delivered to your inbox
Alignment, Reward Hacking, and Autonomous Cyberattacks
Alignment alone is not enough to make autonomous AI safe. Security guardrails support alignment during training and constrain unauthorized actions in deployment.
Introducing Agentic Pentesting
depthfirst’s agents now connect code and runtime across the full pentesting lifecycle, discovering vulnerabilities in your running applications from black-box testing to validating their exploitability and verifying fixes.
General AI vs. Security Focused Code Reviews
At depthfirst, we run Codex alongside the depthfirst PR Security Reviewer. This gives us a direct comparison between general-purpose code review and a system built specifically for security.
How Agents Transform Reachability in the Software Supply Chain
Static call graphs cover the easy cases. An agent reads the code the way an engineer would, so it can follow the invocations a graph misses, in whatever language it finds, across as many packages as the chain runs through.
Building the Means to Stay in Control
Cybersecurity can help us retain control as AI becomes more capable and autonomous by securing the systems through which it acts.
.png)
Introducing Dependency Firewall with On-Device Protection
Dependency Firewall helps organizations detect and block malicious packages before they are installed by people or AI tools.
Preventing Supply Chain Attacks While Agents Work
AI agents have turned dependency malware from a developer risk into an organization-wide threat. Existing agents may bypass controls, enforcement has to reach both the registry, and the device where they operate.
.png)
Abliteration and the Risks Ahead
Abliterating a capable model’s cyber safeguards can create broad, unpredictable risks before defenders have had time to prepare. The security industry should use this window to strengthen defenses at scale.
Bug Bounties Are Not Dead
AI has broken the economics of manually validating every vulnerability report. Forward a report to depthfirst to test its claim against your running application and get the evidence needed to make a decision.
Reachable doesn’t mean exploitable
Reachability shows whether an application can invoke vulnerable behavior. Exploitability evaluates whether every condition required for a practical attack holds in the application’s actual repository and deployment context.
.png)
Product Release: Threat Model
Introducing Threat Model, living security artifacts that capture each repository’s architecture, trust boundaries, and assumptions so vulnerability discovery and severity reflect how your application actually works.
Graduating from CyberGym Level 1
CyberGym Level 1 helped move cybersecurity evaluation forward, but its scores have compressed at the top and its task design captures only a narrow slice of real-world security work. The industry should graduate to harder, end-to-end benchmarks that test discovery, reachability, PoC generation, patching, and regression-free verification.
Product Release: Workflows
Introducing Workflows, an automation layer that turns security events into repeatable actions, routing each finding to the right tool, team, and process so remediation never waits on a manual handoff.
2026: The Year Cyberattacks Became Autonomous
2026 is the year cyberattacks became autonomous. The Hugging Face intrusion shows what machine-speed, multi-stage campaigns are now possible, and why defenders need systems that can respond at the same pace.
Almanax is joining depthfirst
We're excited to welcome Francesco, Maxwell, and the Almanax team to depthfirst as we accelerate progress toward our mission of securing the world's software.
Why Defenders Can’t Bet on One Model
Critical security capabilities cannot depend on infrastructure customers do not control. The next generation of AI security products needs to adapt across models, providers, policies, and access changes while preserving consistent enterprise outcomes.
Introducing Dependency Firewall
Dependency Firewall reviews every open-source package being downloaded anywhere in your company and blocks malicious ones before they reach the person or system that asked for them.
Cybersecurity's ChatGPT Moment
The next phase of cybersecurity will be shaped by AI systems that can discover vulnerabilities at unprecedented scale, cheaper offensive capability through open-source models, and growing pressure on defenders to move faster. As attacks become more automated and sophisticated, security will turn into an arms race of intelligence, pushing organizations to invest more heavily in AI-native defense and accelerating consolidation across the security market.
Securing the World’s Software in the Age of AI
AI is making attacks faster, cheaper, and more sophisticated. As software becomes the foundation of every critical system, securing it requires a new approach, one built on AI that can reason through and fix vulnerabilities in live environments.
Applied AI Lab depthfirst Announces $80 Million in Series B Funding
Applied AI Lab depthfirst Announces $80 Million in Series B Funding Introduces first in-house security model dfs-mini1 demonstrating the power of domain specialized AI
depthfirst Announces $40M Series A to Secure the World’s Software
depthfirst Announces $40M Series A to Secure the World’s Software Major spike in AI-driven exploits sees startup land fresh funding to deploy General Security Intelligence with custom AI agents that work 24/7 to secure businesses’ systems
Product Release: Secrets
Introducing Secrets, a new approach to secret scanning that finds and verifies real leaked credentials so teams can fix what matters.